Managed XDR

6d46fe6c4103505d1f5ef6...1766795555258692294.gz (Cutwail) — malware analysis report

File info

Filename
6d46fe6c4103505d1f5ef6795c2975a497bffd95b85100d9ea6ebfa753fd357f-1766795555258692294.gz
File type
gzip compressed data
File size
21.3 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
cf5b6eb7588325b8fdaa1a02b633b29ad901cc26
SHA256
89b9abf70e1e97fef5deb7635de39426d263b66c922512993fcc6a6ebf7847ab
MD5
0a7b4873d8a3a0673b3264cc75260fd1

Malwares

  • Cutwail

Signatures

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1027.002 unnamed_memory_regions_contains_pe: One or several unnamed memory regions are PE files
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Command and Control

T1071 internet_security_options: Sets Internet connections options that are not secure
T1071.001 network_cnc_http: Suspicious HTTP traffic
T1032 internet_security_options: Sets Internet connections options that are not secure
T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

suricata_alert: Malicious traffic detected
creates_exe: Creates executable files in the file system
copies_self: Creates a copy of itself
dns_without_resolve: DNS query without a response
dead_host: Connects to IP addresses that do not respond to requests
dns_tld_cc: Connects to TLD .CC, possibly malware
only_exec_in_archive: The archive contains only an executable file
network_ftp: Performs FTP requests
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
writes_data: Writes big amount of data to disk
js_suspicious: Suspicious javascript

Related reports